!/bin/bash
state="true"
while statedoSMALLREQUESTS=(netstat -ant | awk -F'[ :]+' '/:22/{count[4]++} END {for(ip in count) print count[ip]}' | sort -n | head -20 | head -1) if [ "SMALL_REQUESTS" -gt 500 ];then
sar -A > alert.txt
state="false"
else
sleep 6
continue
fi
done
